AcraRollback

Rolling back your database

Encrypting your sensitive data might feel like a solely one-way process — but what do you do if you change your mind, need to change the key layout (i.e. go from a zoneless mode to using Zones or vice-versa), or re-generate all the keys?

The answer is to perform a rollback. You could do the rollback yourself, manually — by crafting special requests within your app, accumulating the results, and then converting them into database inserts again. However, we've created a convenient utility to help you generate a clean SQL dump from an existing protected one.

WARNING: For security reasons, we advise you to perform the following procedures on AcraServer exclusively!

--keys_dir — path to the folder where the utility will search for private keys for decryption (using <client_id> or <zone_id>).

--mysql_enable — use this flag to work with MySQL database.

--output_file — filename or path to the file which will be used for dump insert queries.

--postgresql_enable — use this flag to work with PostgreSQL database.

--select — query that will be used for fetching data for decryption. The query should return two columns (Zone Id, encrypted data) with --zonemode_enable flag and one column with encrypted data without this parameter (default).

--zonemode_enable tells the utility to fetch two columns and to use the first for decrypting with a Zone.

Quote escaping for command line would turn a typical request into either:

Decrypting AcraStructs without Zones

select SQL query for fetching the data from the database --select "select data from data_table;";

insert SQL query with a placeholder $1 instead of which the data will be placed or bound for insertion directly into database (if you use --execute param) --insert 'insert into test_insert(data) values($1);;

client id for finding key --client_id=onekey;

connection string that will be used to connect to db --connection_string="dbname=some_database user=postgres password=postgres host=127.0.0.1 port=5432".

The script will search for the key in .acrakeys folder with the name <client_id>, then generate SQL insert queries to file decrypted.sql. If you use --execute argument, the script will insert the data into the database, too. If you don't want to create an output file while executing insert, pass an empty filename, i.e.: --output_file="".

If the decryption is successful, data.txt will contain the encrypted data separated by \n.

Poison records

AcraRollback (acra_rollback) currently ignores poison records. Security-wise, the consideration is that if you can run CLI commands on the server that holds all the private keys, you can compromise the system anyway. You can read more about poison records on the corresponding documentation page.